ResonateII
'ResonateII '(or Resonate 2) is a non-resident prepending parasitic virus on Microsoft Windows, and the successor of the original Resonate, now targeting Windows XP and up. It was created and submitted to Danooct1's "viewer-made malware" segment, as an alternative to the original. File Structure ResonateII is exactly like its predecessor, two programs, a file infecting virus and a trojan. The virus does the same thing as the original, but also adds more registry entries to make it even more deadly. Payloads ResonateII features several payloads, some are now destructive. It first does the following if it was first run: *Disables Task Manager, even Ctrl+Alt+Del/Ctrl+Shift+Esc does not work. *Infects all files, like the original. *Disables Folder Options. After this procedure finishes, it reboots the computer. When the desktop loads and the month is October, it has a 1/16 chance to show a pixelized picture of Morbid Patrick, and then plays psychotic music on loop. The Patrick image will go to the front of everything. It can do the following at anytime: *Overwrite .vbs and .bat files, so it runs the virus first then the code. It checks the date at every boot, and if the date matches one of several prerequisite dates, it will activate one of its payloads, most of them whenever an infected program is run. * January 1st - Overwrites .html files, to the same page from CodeRed. * February 16th - Same as original, plays "Grass Beach" by YouTube user LtKittenKiss on loop. * April 20th - Replaces the wallpaper with a cannabis leaf (this is fixed from original). * May 30th - Shows a video clip from Futurama, then logs the user off when a program is run. *June 17th - Changes the background and displays a message. * September 4th - Attempts to open FitTea.org when a program is run (this is fixed from the original). *October 1st - Uses Joshi's payload, except the message to type is "Happy Birthday Dan", which is a reference to danooct1 himself. * December 30th - Covers the screen in the virus' intro, and it stays there until the computer is rebooted, attempting to block any effort to terminate it. When the computer is rebooted, all programs that are run will display a message saying that today is a "very special day" and not run. About 5-15 months after activation, it will do its deadly payload. It will use the NavaShield laugh, overwrites most files, change the background to the same Fred Durst from the original Resonate, disables Run and accessing drives, replaces files with a garbage one, and displays a message box. After a while, it displays another message and logs off the user. It adds another message to the login screen and added a bunch of accounts with random names. The account previously used is now named Administrator and the password has been changed to "resonate". When rebooted, it changes the MBR to Opaserv's. References * https://www.youtube.com/watch?time_continue=7&v=rW5YxV8gML4 - Grass Beach Category:Virus Category:Trojan Category:Win32 Category:Win32 trojan Category:Trojan dropper Category:Win32 virus Category:MBR overwriting viruses Category:Microsoft Windows